Is this you? Claim this profile to correct it, add a bio and choose the work people see first.
Claim this profileAcademic lineage
Possible advisorsa guess from early papers, not confirmed
- Tie- Yan LiuSuggested from co-authorship
- Jun ZhuSuggested from co-authorship
Is this you? Claim this profile to confirm or dismiss it.
Works126 from public data
- 3,499
- Understanding R1-Zero-Like Training: A Critical Perspective1,439
This work critically examine R1-Zero-like training by analyzing its two core components: base models and RL, and introduces Dr. GRPO, an unbiased optimization method that improves token efficiency while maintaining reasoning performance.
- Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks1,164
A translation-invariant attack method to generate more transferable adversarial examples against the defense models, which fools eight state-of-the-art defenses at an 82% success rate on average based only on the transferability, demonstrating the insecurity of the current defense techniques.
- Defense Against Adversarial Attacks Using High-Level Representation Guided Denoiser1,059
High-level representation guided denoiser (HGD) is proposed as a defense for image classification by using a loss function defined as the difference between the target model's outputs activated by the clean image and denoised image.
- LoraHub: Efficient Cross-Task Generalization via Dynamic LoRA Composition435
This paper investigates LoRA composability for cross-task generalization and introduces LoraHub, a simple framework devised for the purposive assembly of LoRA modules trained on diverse given tasks, with the objective of achieving adaptable performance on unseen tasks.
- Adversarial Attacks and Defences Competition364
In this chapter, the structure and organization of the NIPS 2017 competition is described and the solutions developed by several of the top-placing teams are described.
- Better Diffusion Models Further Improve Adversarial Training327
This paper gives an affirmative answer by employing the most recent diffusion model which has higher efficiency and image quality compared with DDPM and achieves state-of-the-art performance on RobustBench using only generated data (no external datasets).
- 308
- 218
- Scaling up Masked Diffusion Models on Text213
The first scaling law for MDMs is established, demonstrating a scaling rate comparable to autoregressive models (ARMs) and a relatively small compute gap.
- RegMix: Data Mixture as Regression for Language Model Pre-training196
RegMix is proposed to automatically identify a high-performing data mixture by formulating it as a regression task and consistently outperforms human selection in experiments involving models up to 7B models trained on 100B tokens, while matching or exceeding DoReMi using just 10% of the computational resources.
- A Recipe for Watermarking Diffusion Models196
This work conducts comprehensive analyses and derives a recipe for efficiently watermarking state-of-the-art DMs (e.g., Stable Diffusion), via training from scratch or finetuning, providing a foundation for future research on water marking DMs.
- Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast182
The results show that feeding an (infectious) adversarial image into the memory of any randomly chosen agent is sufficient to achieve infectious jailbreak, and derive a simple principle for determining whether a defense mechanism can provably restrain the spread of infectious jailbreak.
- 168
- On Memorization in Diffusion Models140
This study quantifies the impact of the influential factors on memorization behaviors in diffusion models, and defines effective model memorization (EMM), a metric measuring the maximum size of training data at which a learned diffusion model approximates its theoretical optimum.
- Black-box Detection of Backdoor Attacks with Limited Information and Data140
This paper proposes a black-box backdoor detection (B3D) method to identify backdoor attacks with only query access to the model and introduces a gradient-free optimization algorithm to reverse-engineer the potential trigger for each class, which helps to reveal the existence of backdoor attacks.
- Improved Techniques for Optimization-Based Jailbreaking on Large Language Models134
Improved techniques for optimization-based jailbreaks like GCG are presented and demonstrated that they can help GCG outperform state-of-the-art jailbreaking attacks and achieve nearly 100% attack success rate.
- Weak-to-Strong Jailbreaking on Large Language Models130
The weak-to-strong jailbreaking attack is proposed, an efficient inference time attack for aligned LLMs to produce harmful text, based on the observation that jailbroken and aligned models only differ in their initial decoding distributions.
- Towards Face Encryption by Generating Adversarial Identity Masks127
This work proposes a targeted identity-protection iterative method (TIP-IM) to generate adversarial identity masks which can be overlaid on facial images, such that the original identities can be concealed without sacrificing the visual quality.
- Finetuning Text-to-Image Diffusion Models for Fairness120
The method markedly reduces gender, racial, and their intersectional biases for occupational prompts and supports diverse perspectives of fairness beyond absolute equality, which is demonstrated by controlling age to a young and old distribution while simultaneously debiasing gender and race.
- Bag of Tricks for Training Data Extraction from Language Models100
The experimental results show that several previously overlooked tricks can be crucial to the success of training data extraction, and proposed tricks outperform the baseline by a large margin in most cases, providing a much stronger baseline for future research.
- 98
- Discovering Adversarial Examples with Momentum98
A strong attack algorithm named momentum iterative fast gradient sign method (MI-FGSM) is proposed to discover adversarial examples and can serve as a benchmark attack algorithm for evaluating the robustness of various models and defense methods.
- 89
- Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety76
This survey provides a systematic review of current safety research on large models, covering Vision Foundation Models, Large Language Models, Vision-Language Pre-training models, Vision-Language Models, Diffusion Models, and large-model-powered Agents, and presents a comprehensive taxonomy of safety threats to these models.
- Reinforcing General Reasoning without Verifiers75
A verifier-free method (VeriFree) that bypasses answer verification and instead uses RL to directly maximize the probability of generating the reference answer is proposed, and insights into this method are provided from multiple perspectives.
- A Closer Look at Machine Unlearning for Large Language Models63
To address the issue of inadequate evaluation of model outputs after unlearning, three additional metrics are introduced to evaluate token diversity, sentence semantics, and factual correctness and to alleviate issues in machine unlearning for LLMs.
- 63
- Bootstrapping Language Models with DPO Implicit Rewards62
This work makes a novel observation that this implicit reward model can by itself be used in a bootstrapping fashion to further align the LLM, and shows great improvements in alignment.
- Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift61
A multimodal attribution backdoor attack (MABA) is proposed that injects domain-agnostic triggers into critical areas using attributional interpretation and boosts the attack success rate of generalization over the unimodal attack.
- Test-Time Backdoor Attacks on Multimodal Large Language Models60
AnyDoor is presented, a test-time backdoor attack against multimodal large language models (MLLMs), which involves injecting the backdoor into the textual modality using adversarial test images (sharing the same universal perturbation), without requiring access to or modification of the training data.
- Orient Anything: Learning Robust Object Orientation Estimation from Rendering 3D Models57
Orient Anything is introduced, the first expert and foundational model designed to estimate object orientation in a single- and free-view image and achieves state-of-the-art orientation estimation accuracy in both rendered and real images and exhibits impressive zero-shot ability in various scenarios.
- Intriguing Properties of Data Attribution on Diffusion Models57
This work presents a significantly more efficient approach for attributing diffusion models, while the unexpected findings suggest that at least in non-convex settings, constructions guided by theoretical assumptions may lead to inferior attribution performance.
- Diffusion Language Models are Super Data Learners54
A Crossover: when unique data is limited, diffusion language models (DLMs) consistently surpass autoregressive (AR) models by training for more epochs by attributing the gains to three compounding factors: any-order modeling, super-dense compute from iterative bidirectional denoising, and built-in Monte Carlo augmentation.
- Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks52
A conditional generative attacking model is proposed, which can generate the adversarial examples targeted at different classes by simply altering the class embedding and share a single backbone, which improves the success rates of targeted black-box attacks by a significant margin over the existing methods.
- Meta-Unlearning on Diffusion Models: Preventing Relearning Unlearned Concepts51
The proposed metaunlearning framework is compatible with most existing unlearning methods, requiring only the addition of an easy-to-implement meta objective, and validated through empirical experiments on meta-unlearning concepts from Stable Diffusion models (SD-v1-4 and SDXL), supported by extensive ablation studies.
- Cheating Automatic LLM Benchmarks: Null Models Achieve High Win Rates49
It is shown that even a"null model" that always outputs a constant response (irrelevant to input instructions) can cheat automatic benchmarks and achieve top-ranked win rates, and call for the development of anti-cheating mechanisms for reliable automatic benchmarks.
- Muon Outperforms Adam in Tail-End Associative Memory Learning46
The empirical observations and theoretical analyses reveal Muon's core advantage: its update rule aligns with the outer-product structure of linear associative memories, enabling more balanced and effective learning of tail classes in heavy-tailed distributions than Adam.
- Denial-of-Service Poisoning Attacks against Large Language Models45
P-DoS attacks for LLMs are proposed, demonstrating that injecting a single poisoned sample designed for DoS purposes can break the output length limit, and comprehensive ablation studies on open-source LLMs are performed.
- 41
- Rethinking the Trust Region in LLM Reinforcement Learning36
Divergence Proximal Policy Optimization (DPPO) is proposed, which substitutes heuristic clipping with a more principled constraint based on a direct estimate of policy divergence (e.g., Total Variation or KL).
- 34
- Purifying Large Language Models by Ensembling a Small Language Model33
This study proposes a simple and easily implementable method for purifying LLMs from the negative effects caused by uncurated data, namely, through ensembling LLMs with benign and small language models (SLMs).
- 33
- Exploring Incompatible Knowledge Transfer in Few-shot Image Generation32
This work investigates an underexplored issue in FSIG, dubbed as incompatible knowledge transfer, which would significantly degrade the realisticness of synthetic samples and proposes knowledge truncation, which is a complementary operation to knowledge preservation and is implemented by a lightweight pruning-based method.
- Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart28
This work finds that confidence and a rectified confidence can form two coupled rejection metrics, which could provably distinguish wrongly classified inputs from correctly classified ones, and sheds light on using coupling strategies to better detect and reject adversarial examples.
- Benchmarking Large Multimodal Models against Common Corruptions25
The cross-modal interactions between text, image, and speech, encompassing four essential generation tasks: text-to-image, image-to-text, text-to-speech, and speech-to-text, are investigated.
- 24
- 24
- OpenSearch-VL: An Open Recipe for Frontier Multimodal Search Agents22
This work introduces OpenSearch-VL, a fully open-source recipe for training frontier multimodal deep search agents with agentic reinforcement learning and proposes a multi-turn fatal-aware GRPO training algorithm that handles cascading tool failures by masking post-failure tokens while preserving useful pre-failure reasoning through one-sided advantage clamping.
- Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw22
The first real-world safety evaluation of OpenClaw is presented and the CIK taxonomy is introduced, which unifies an agent's persistent state into three dimensions, i.e., Capability, Identity, and Knowledge, for safety analysis, showing that the vulnerabilities are inherent to the agent architecture.
- LongSpec: Long-Context Lossless Speculative Decoding with Efficient Drafting and Verification22
LongSpec is introduced, a framework that addresses three key challenges of speculative decoding through three core innovations: a memory-efficient draft model with a constant-sized KV cache; novel position indices that mitigate the training-inference mismatch; and an attention aggregation strategy that combines fast prefix computation with standard tree attention to enable efficient decoding.
- Improving Long-Text Alignment for Text-to-Image Diffusion Models21
LongAlign, which includes a segment-level encoding method for processing long texts and a decomposed preference optimization method for effective alignment training, and provides decomposed CLIP-based preference models to fine-tune diffusion models.
- Error Analyses of Auto-Regressive Video Diffusion Models: A Unified Framework20
Meta-ARVDM is introduced, a unified analytical framework that studies both errors through the shared autoregressive structure of AR-VDMs and shows that temporal degradation can be quantified by the cumulative sum of per-step errors, enabling prediction of degradation for different schedulers without video rollout.
- Sailor2: Sailing in South-East Asia with Inclusive Multilingual LLMs20
It is hoped that Sailor2 model (Apache 2.0 license) will drive language development in the SEA region, and Sailor2 cookbook will inspire researchers to build more inclusive LLMs for other under-served languages.
- 20
- 20
- Robust Deep Learning via Reverse Cross-Entropy Training and Thresholding Test.20
This paper attempts to improve the robustness of deep learning methods by presenting a new training procedure and a thresholding test strategy to minimize the reverse cross-entropy, which encourages a deep network to learn latent representations that better distinguish adversarial samples from normal ones.
- Efficient Process Reward Model Training via Active Learning18
This work proposes an active learning approach, ActPRM, which proactively selects the most uncertain samples for training, substantially reducing labeling costs, and further advances the actively trained PRM by filtering over 1M+ math reasoning trajectories with ActPRM, retaining 60% of the data.
- Improving Your Model Ranking on Chatbot Arena by Vote Rigging18
O omnipresent rigging strategies are proposed, exploiting the Elo rating mechanism of Chatbot Arena that any new vote on a battle can influence the ranking of the target model $m_{t}$, even if $m_{t}$ is not directly involved in the battle.
- When Precision Meets Position: BFloat16 Breaks Down RoPE in Long-Context Training18
AnchorAttention is developed, a plug-and-play attention method that alleviates numerical issues caused by BFloat16, improves long-context capabilities, and speeds up training, and reduces training time by over 50% compared to standard full attention mechanisms.
- Your Large Language Model is Secretly a Fairness Proponent and You Should Prompt it Like One17
FairThinking is developed, a pipeline designed to automatically generate roles that enable LLMs to articulate diverse perspectives for fair expressions that validate that prompting LLMs with specific roles can allow LLMs to express diverse viewpoints.
- 17
- Nonparametric Generative Modeling with Conditional Sliced-Wasserstein Flows17
This work proposes Conditional Sliced-Wasserstein Flow (CSWF), a simple yet effective extension of SWF that enables nonparametric conditional modeling and introduces appropriate inductive biases of images into SWF with two techniques inspired by local connectivity and multiscale representation in vision research, which greatly improve the efficiency and quality of modeling images.
- A Roadmap for Big Model17
This paper discusses not only the BM technologies themselves but also the prerequisites for BM training and applications with BMs, dividing the BM review into four parts: Resource, Models, Key Technologies and Application.
- Fostering Video Reasoning via Next-Event Prediction16
Experiments validate that NEP offers a scalable and effective training paradigm for fostering temporal reasoning in MLLMs, and introduce FutureBench to assess coherence in predicting unseen future events.
- BAFFLE: A Baseline of Backpropagation-Free Federated Learning16
Back Propagation-free federated learning is developed, dubbed BAFFLE, in which backpropagation is replaced by multiple forward processes to estimate gradients and is well-suited to trusted execution environments.
- LIFT the Veil for the Truth: Principal Weights Emerge after Rank Reduction for Reasoning-Focused Supervised Fine-Tuning15
It is stated that weights with the largest magnitude after low-rank approximation are critical weights for fine-tuning, which the authors call Principal Weights, and surprisingly, while magnitude-based sparse fine-tuning performs poorly as a baseline on LLM fine-tuning, it becomes highly effective after rank reduction.
- 14
- 14
- Face3DAdv: Exploiting Robust Adversarial 3D Patches on Physical Face Recognition13
By reassessing the intrinsic relationship between an attacker’s face and its variations, a practical pipeline is proposed that simulates complex facial transformations in the physical world through 3D face modeling and can achieve an effective evaluation of adversarial robustness on multiple popular commercial services.
- Controllable Evaluation and Generation of Physical Adversarial Patch on Face Recognition12
This work proposes to simulate the complex transformations of faces in the physical world via 3D-face modeling, which serves as a digital counterpart of physical faces, and proposes a Face3DAdv method considering the 3D face transformations and realistic physical variations.
- Towards Privacy Protection by Generating Adversarial Identity Masks12
This paper proposes a targeted identity-protection iterative method (TIP-IM), which can generate natural face images by adding adversarial identity masks to conceal ones' identity against a recognition system.
- 12
- 10
- CoSDA: Continual Source-Free Domain Adaptation9
This work proposes a continual source-free domain adaptation approach named CoSDA, which employs a dual-speed optimized teacher-student model pair and is equipped with consistency learning capability and outperforms state-of-the-art approaches in continuous adaptation.
- Unnatural Languages Are Not Bugs but Features for LLMs8
This work demonstrates that unnatural languages - strings that appear incomprehensible to humans but maintain semantic meanings for LLMs - contain latent features usable by models, and demonstrates that models fine-tuned on unnatural versions of instruction datasets perform on-par with those trained on natural language.
- 8
- 7
- 6
- 6
- Suspicious Alignment of SGD: A Fine-Grained Step Size Condition Analysis5
A step size interval exists where projecting the SGD updates to the bulk space decreases the loss while projecting them to the dominant space increases the loss, which explains a recent empirical observation that projecting gradient updates to the dominant subspace is ineffective.
- Rethinking the Divergence Regularization in LLM RL5
Divergence Regularized Policy Optimization (DRPO) is proposed, which replaces the hard mask with a smooth advantage-weighted quadratic regularizer on policy shift and improves the stability and efficiency of LLM RL training.
- Imperceptible Jailbreaking against Large Language Models5
This paper introduces imperceptible jailbreaks that exploit a class of Unicode characters called variation selectors that appear visually identical to original malicious questions on screen, while their tokenization is"secretly"altered.
- Real-time Identity Defenses against Malicious Personalization of Diffusion Models5
The Real-time Identity Defender is introduced, a neural network designed to generate adversarial perturbations through a single forward pass, bypassing the need for image-specific optimization, and envisioned to play a crucial role in safeguarding portrait rights, thereby preventing illegal and unethical uses.
- Flow-DPPO: Divergence Proximal Policy Optimization for Flow Matching Models4
Experiments show that Flow-DPPO achieves higher rewards with better KL-proximal efficiency, alleviates catastrophic forgetting, promotes balanced multi-objective optimization, and enables stable multi-epoch training where ratio clipping degrades.
- TempAct: Advancing Temporal Plausibility in Autoregressive Video Generation via Planner-Executor RL4
This work designs hierarchical rewards that combine plan-quality and full-video temporal feedback for the planner with local transition-level step-following rewards, aesthetic regularization, and KL constraints for the executor, and shows that TempAct improves temporal consistency while preserving overall visual quality.
- Think in Parallel, Answer as One: Logit Averaging for Open-Ended Reasoning4
ThinkMerge is introduced, a training-free, plug-and-play decoding strategy that runs K parallel reasoning traces and averages their next-token logits at synchronization points to produce a single coherent output, demonstrating that parallel test-time scaling can benefit open-ended reasoning without relying on voting over complete outputs.
- $O(N^2)$ Universal Antisymmetry in Fermionic Neural Networks4
It is formally proved that the pairwise construction built upon permutation-equivariant architectures can universally represent any antisymmetric function, which can be achieved via continuous approximators when the authors aim to represent ground-state wavefunctions.
- Demystifying the Slash Pattern in Attention: The Role of RoPE3
This paper analyzes the training dynamics of a shallow Transformer equipped with RoPE under these conditions, and proves that models trained via gradient descent exhibit SDHs, which are intrinsic to models and generalize to out-of-distribution prompts.
- Scaling GUI Agents with Visual State Transitions3
Empirical studies show that joint dynamics optimization yields stable improvements over single-objective training, and downstream performance scales steadily with the volume of transition data.
- From Spikes to Heavy Tails: Unveiling the Spectral Evolution of Neural Networks3
This work presents a theory-informed analysis for ‘crafting’ heavy tails in the ESD of two-layer NNs without any gradient noise, and highlights the role of optimizer-dependent learning rates on the Bulk+Spike and HT shape of the ESDs in the early phase of training, which can facilitate generalization in the two-layer NN.
- Improving Adversarial Robustness of DEQs with Explicit Regulations Along the Neural Dynamics3
This work interprets DEQs through the lens of neural dynamics and finds that AT under-regulates intermediate states, and proposes reducing prediction entropy by progressively updating inputs along the neural dynamics.
- 3
- 2
- 2
- 2
- 2
- Balancing Learning Rates Across Layers: Exact Two-Step Dynamics and Optimal Scaling in Linear Neural Networks1
This work derives the exact closed-form expressions for the gradients and test loss after one and two steps of gradient descent, enabling a precise characterization of early training dynamics and reveals a distinct early-training regime.
- JarvisHub: An Open Harness for Canvas-Native Multimodal Creative Agents1
JarvisHub is introduced, a canvas-native creative agent harness for long-horizon multimodal creation, where agents can progressively plan, generate, revise, and organize multimodal projects while users remain able to inspect, guide, and intervene throughout the process.
- Unveiling Multi-regime Patterns in SciML: Distinct Failure Modes and Regime-specific Optimization1
This paper studies multi-regime behavior in scientific machine learning (SciML) models through a regime-aware diagnostic framework that jointly analyzes performance, training dynamics, and loss-landscape geometry, finding a consistent three-regime structure.
- 1
- 1
- AdAM: Few-Shot Image Generation via Adaptation-Aware Kernel Modulation1
It is revealed that under setups which assumption of close proximity between source and target domains is relaxed, many existing state-of-the-art (SOTA) methods which consider only source domain in knowledge preserving perform no better than a baseline method.
- 1
- 1
- 1
- 1
- –
- Predictive Divergence Masks for LLM RL–
The predictive divergence mask is proposed, which asks whether the next policy-gradient step will increase or decrease the same divergence used by the trust region, and the resulting masks improve RL training across model scales and precision settings.
- Scalable Token-Level Hallucination Detection in Large Language Models–
TokenHD is proposed, a holistic pipeline for training token-level hallucination detectors that operates directly on free-form text to identify hallucinations, eliminating the need for predefined step segmentation or additional text reformatting and can generalize well across diverse practical scenarios.
- –
- –
- –
- –
- –
- –
- –
- –
- –
- –
- –
- –
- –
- –
- –
Publication data from OpenAlex, with missing venues and authors filled in from Crossref; citation counts are the higher of OpenAlex and Semantic Scholar, last synced 2026-10-12. One-sentence summaries under some papers are written by Semantic Scholar’s model. Citation counts may be lower than on Google Scholar, which indexes more sources.
Report an error
Wrong papers, two people merged into one, or a profile that should not be here? Tell us and we will fix or hide it.